Server security inspection method and apparatus based on domain name list

Abstract

This invention provides a server security inspection method and apparatus based on a domain name list, comprising: generating a target domain name list based on a pre-stored domain name list, and inputting the target domain name list into a database to obtain an initial database table; simultaneously performing periodic distributed scanning on the domain names and subdomains in the initial database table at a preset frequency using different scanning nodes to obtain scanning results; performing risk checks on the scanning results according to a security risk check list to obtain risk check results; performing risk category statistics based on the risk check results to obtain statistical results; and generating a risk assessment result based on the statistical results. This invention, based on a target domain name list, utilizes a distributed parallel scanning method combined with subdomain discovery technology to perform server security risk checks, improving the accuracy, speed, and coverage of security checks, achieving a more comprehensive and less omission-prone security inspection.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to a method and apparatus for server security inspection based on a domain name list. Background Technology

[0002] With the rapid development of the internet, the importance of network security is increasing daily, and server security testing is a crucial issue in network security. The configuration of TLS and digital certificates on a server is a significant source of server security. The TLS protocol is the most widely used internet security protocol today, using cryptographic techniques to ensure data encryption between communicating parties and relying on the PKI certificate system to provide identity authentication for both parties, forming the foundation of modern internet security. In the PKI system, Certificate Authorities (CAs) issue digital certificates and provide trust relationships; network service terminals need to deploy digital certificates to complete identity authentication.

[0003] However, numerous studies and reports in recent years have confirmed the security risks associated with the deployment of TLS and digital certificates. For example, a recently discovered TLS downgrade attack might involve a web server deployed on multiple IP addresses for load balancing. These IP addresses share the same domain name but require separate TLS configurations. If the TLS security configuration of one of these IP addresses fails, a potential man-in-the-middle attacker can use hijacking and redirection to perform a TLS downgrade attack on all IP addresses of that web server. Traditional TLS scanning methods, which only target the domain name, are ineffective in detecting such attacks.

[0004] Furthermore, trust in the communication process between the client and the terminal TLS service relies on the digital certificate deployed on the terminal service. The expiration of the digital certificate signifies the loss of trust, consequently causing the TLS service to fail. The reasons for digital certificate expiration can be multifaceted, including certificate expiration, revocation of the corresponding certificate trust relationship by the CA vendor, and security issues such as weak keys in the certificate signing algorithm. Therefore, administrators currently need to periodically check the security status of digital certificates.

[0005] In summary, while some existing methods have achieved the detection of TLS configuration vulnerabilities, these methods can only detect older vulnerabilities and cannot check for vulnerabilities such as downgrade attacks caused by differential deployments of the same domain name on different IP addresses. Furthermore, existing security detection methods for SSL / TLS service digital certificates rely on manual inspection, which is complex and difficult to implement. Moreover, for companies with a large number of SSL / TLS services, manual inspection methods are difficult to achieve comprehensive coverage and are prone to omissions.

[0006] In other words, existing technologies suffer from low security inspection efficiency, high omission rate, and incomplete security inspection. Summary of the Invention

[0007] This invention provides a server security inspection method and apparatus based on a domain name list, which solves the defects of low efficiency, high omission rate and incomplete security inspection in the prior art, and achieves a more efficient, less omission-prone and more comprehensive security inspection.

[0008] This invention provides a server security check method based on a domain name list, comprising:

[0009] A target domain name list is generated based on a pre-stored domain name list, and the target domain name list is entered into a database to obtain an initialized database table; the target domain name list includes the domain names in the pre-stored domain name list and the subdomains obtained based on the pre-stored domain name list;

[0010] The domain names and subdomains in the initial database table are periodically and distributedly scanned simultaneously using different scanning nodes at a preset frequency to obtain scan results; the scan results include the IP addresses of the domain names and subdomains in the initial database table.

[0011] The scan results are then subjected to a risk check based on the security risk checklist to obtain the risk check results.

[0012] Based on the risk inspection results, risk categories are statistically analyzed to obtain statistical results;

[0013] Risk assessment results are generated based on the statistical results.

[0014] According to the present invention, a server security inspection method based on a domain name list generates a target domain name list based on a pre-stored domain name list, specifically including:

[0015] The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate;

[0016] Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results;

[0017] Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list;

[0018] Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the query in the pre-stored passive traffic database;

[0019] The first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list are merged to obtain the target domain name list.

[0020] According to the server security inspection method based on a domain name list provided by the present invention, different scanning nodes simultaneously perform periodic distributed scanning on the domain names and subdomains in the initial database table at a preset frequency to obtain the scanning results, and then further includes:

[0021] The scan results are stored in a database.

[0022] According to a server security check method based on a domain name list provided by the present invention, the scan results are stored in the database, specifically including:

[0023] The scan results from different scan nodes are compared and merged, and the data from failed scans is supplemented to obtain the data processing scan results;

[0024] The data processing scan results are incrementally stored in the database by recording timestamps.

[0025] According to a server security check method based on a domain name list provided by the present invention, a risk check is performed on the scan results according to a security risk check list, wherein the security risk check list specifically includes:

[0026] Check if the TLS configurations of different IP addresses under the same domain are identical;

[0027] Check whether the security of the TLS configuration complies with regulations;

[0028] Check if the certificate or certificate chain can be verified.

[0029] Check if the certificate is valid;

[0030] Check if the certificate contains a weak key;

[0031] Check if the OCSP certificate has been revoked;

[0032] Check if the certificate's CRL has been revoked;

[0033] Check the issuing authority of the certificate.

[0034] According to a server security check method based on a domain name list provided by the present invention, risk category statistics are performed based on the risk check results to obtain statistical results, wherein the risk categories include at least one of the following:

[0035] New types of TLS downgrade attack risks;

[0036] TLS configuration risks;

[0037] Invalid certificate;

[0038] The certificate is about to expire;

[0039] The certificate uses a weak signature algorithm or key;

[0040] The certificate was revoked;

[0041] The certificate issuing authority provides a reminder.

[0042] The present invention also provides a server security inspection device based on a domain name list, comprising:

[0043] An initialization unit is used to generate a target domain name list based on a pre-stored domain name list and input the target domain name list into a database to obtain an initial database table; the target domain name list includes domain names in the pre-stored domain name list and subdomain names obtained based on the pre-stored domain name list;

[0044] A scanning unit is used to simultaneously perform periodic distributed scanning of the domain names and subdomains in the initialization database table using different scanning nodes at a preset frequency to obtain scanning results; the scanning results include the IP addresses of the domain names and subdomains in the initialization database table.

[0045] The inspection unit is used to perform a risk check on the scan results according to the security risk check list to obtain the risk check results;

[0046] The statistical unit is used to perform risk category statistics based on the risk inspection results to obtain statistical results;

[0047] An assessment unit is used to generate risk assessment results based on the statistical results.

[0048] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the server security check method based on the domain name list as described above.

[0049] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the server security check method based on a domain name list as described above.

[0050] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the server security check method based on a domain name list as described above.

[0051] This invention provides a server security inspection method and apparatus based on a domain name list. The method generates a target domain name list based on a pre-stored domain name list and inputs the target domain name list into a database to obtain an initial database table. The target domain name list includes domain names from the pre-stored domain name list and subdomain names obtained from the pre-stored domain name list. Different scanning nodes simultaneously perform periodic distributed scans on the domain names and subdomain names in the initial database table at a preset frequency to obtain scan results. The scan results include the IP addresses of the domain names and subdomain names in the initial database table. Risk checks are performed on the scan results according to a security risk check list to obtain risk check results. Risk category statistics are performed based on the risk check results to obtain statistical results. A risk assessment result is generated based on the statistical results. This invention, based on a target domain name list, utilizes a distributed parallel scanning method combined with subdomain discovery technology for server security risk inspection, improving the accuracy, speed, and coverage of security inspections, achieving a more comprehensive and less omission-prone security inspection. Attached Figure Description

[0052] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0053] Figure 1 This is one of the flowcharts illustrating the server security check method based on a domain name list provided by the present invention;

[0054] Figure 2 This is the second flowchart of the server security check method based on a domain name list provided by the present invention;

[0055] Figure 3 This is a schematic diagram of the server security inspection device based on a domain name list provided by the present invention;

[0056] Figure 4 This is a schematic diagram of the structure of the electronic device provided by the present invention.

[0057] Figure label:

[0058] 310: Initialization unit; 320: Scanning unit; 330: Checking unit; 340: Statistical unit; 350: Evaluation unit;

[0059] 410: Processor; 420: Communication interface; 430: Memory; 440: Communication bus. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0061] The following is combined with Figures 1-2 The present invention describes a server security check method based on a domain name list. Figure 1 This is one of the flowcharts illustrating the server security check method based on a domain name list provided by the present invention, such as... Figure 1 As shown, it includes the following steps:

[0062] Step 110: Generate a target domain name list based on the pre-stored domain name list, and enter the target domain name list into the database to obtain an initialized database table; the target domain name list includes the domain names in the pre-stored domain name list and the subdomains obtained according to the pre-stored domain name list.

[0063] The pre-stored domain name list is a specified list of domain names to be monitored, representing the domain names the user wishes to monitor. This list can be user-inputted or an industry-default monitoring domain name list. A subdomain (or subdomain) is a domain belonging to a higher-level domain in the Domain Name System (DNS). For example, mail.example.com and calendar.example.com are two subdomains of example.com, which in turn is a subdomain of the top-level domain .com. This invention supplements and expands the user's list of domain names to be monitored through subdomain discovery. This is because in large enterprises and institutions, commonly used domain names often have complex and numerous subdomains, which may lack unified management, potentially posing security risks and management gaps, thus requiring inclusion in the monitoring list. Specifically, three methods are used to execute the subdomain discovery process. In some embodiments, this process can utilize probe nodes located at different points in the network topology to complete the subdomain discovery process.

[0064] Method 1:

[0065] The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate.

[0066] Specifically, by completing a TLS handshake, the certificates of each domain in the pre-stored domain list are obtained. This pre-stored domain list is a specified list of domains to be monitored; it is the list of domains the user wishes to monitor. This list can be a user-inputted list or an industry-default monitoring domain list. Next, the SAN field of the certificates for each domain in the pre-stored domain list is parsed, and all domains in the SAN field are saved, resulting in subdomains and related domains. These subdomains and related domains form the first domain list.

[0067] Method 2:

[0068] Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results;

[0069] Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list;

[0070] Specifically, a subdomain list is constructed as a reference subdomain list, and subdomains are enumerated on the target domain list to obtain the enumeration results. In some embodiments, common subdomains can be selected to form the reference subdomain list during its construction. In some embodiments, common subdomains can be obtained using open-source subdomain brute-force tools, such as Sublist3r. In other embodiments, open-source subdomain brute-force tools, including Aquatone and Amass, can also be used to obtain the reference subdomain list. In still other embodiments, common subdomains include: www (commonly used); mail (email); m (commonly used for mobile adaptation); blog (technical blogs, etc.); pop3 (email service); smtp (email service); support (information support page).

[0071] Perform DNS queries on the subdomains in the enumeration result. The response of the DNS query is the IP address corresponding to the subdomain. Determine whether the subdomain exists based on the response; that is, if the subdomain has a corresponding IP address, then the subdomain exists; otherwise, if the subdomain does not have a corresponding IP address, then the subdomain does not exist. Keep the existing subdomains in the enumeration result and delete the non-existent subdomains to obtain the second list of domains.

[0072] Method 3:

[0073] Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the pre-stored passive traffic database.

[0074] Specifically, each domain name in the pre-stored domain name list is queried in the passive traffic database to obtain related subdomains, thus obtaining a list of third-party domain names. In practice, a specific database called Passive DNS exists in the security field, such as VirusTotal. This database records the DNS resolution process, allowing queries to retrieve domain names and related subdomains.

[0075] Once the first, second, and third domain name lists are obtained, the subdomain discovery process is complete.

[0076] In other embodiments, the first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list are merged to obtain the target domain name list, thus supplementing the domain name list.

[0077] In some embodiments, during the execution of the subdomain discovery processes of Method 1, Method 2, and Method 3, iterations can be performed until the target domain list reaches a preset size or no new subdomains can be obtained. That is, the target domain list includes a pre-stored domain list and the iteratively completed first, second, and third domain lists. In other words, the target domain list includes all domains in the pre-stored domain list and all subdomains and related domains discovered based on the pre-stored domain list and the list of commonly used subdomains. In some embodiments, the preset size includes 500. In reality, the size of related domains and subdomains varies for commercial websites of different sizes. In small commercial websites, due to their smaller scale, there are generally only a few to dozens of subdomains, including the main domain, www, mail, and other common subdomains. In medium-sized commercial websites, due to their larger scale, there are generally hundreds to thousands of subdomains, including the main domain, multiple business subdomains, various testing environments, and backup environments. In large commercial websites, due to their very large scale, there are generally tens of thousands to hundreds of thousands of subdomains, including multiple business subdomains, distributed computing environments, CDN caching nodes, etc. For management and research purposes, different approaches can be taken depending on the situation (such as clustering to reduce redundancy of subdomains of the same type).

[0078] In one embodiment, the pre-stored domain name list includes [example.edu.cn]. Through the above process, the subdomains of example.edu.cn are discovered, and a supplementary list [example1.edu.cn, example2.edu.cn, sub1.example.com, sub2.example.com, ...] is obtained. The pre-stored domain name list and the supplementary list are merged to obtain the target domain name list [example.edu.cn, example1.edu.cn, example2.edu.cn, sub1.example.com, sub2.example.com, ...].

[0079] After obtaining the complete list of domain names, all domain names in the target domain name list are entered into the database to obtain the initial database table. The initialization operation of the database table is completed, and it is ready for subsequent scanning.

[0080] Step 120: Use different scanning nodes to simultaneously perform periodic distributed scanning on the domain names and subdomains in the initialization database table at a preset frequency to obtain scanning results; the scanning results include the IP addresses of the domain names and subdomains in the initialization database table.

[0081] After obtaining the initial database table, the scan begins, and the certificates of the target domain name list in the initial database table are obtained, completing the overall analysis of the target domain name system TLS and certificate security.

[0082] In some embodiments, a distributed scanning node is used to complete the scan. That is, different scanning nodes are used simultaneously to scan the domain names and subdomains in the initial database table. Different scanning nodes refer to scanning nodes located in different geographical locations and network topologies. In actual operation, because the servers in the target domain name list may have load balancing configurations, using a single scanning node cannot comprehensively obtain all IP addresses of the target domain names. Using a distributed scanning node library effectively improves this problem. Furthermore, for errors that may occur during the scanning measurement process due to network fluctuations, distributed scanning can improve the accuracy of the scan by comparing and merging the results.

[0083] Furthermore, the distributed scanning of the present invention is periodic and occurs at a preset frequency. In some embodiments, the preset frequency may be once a day.

[0084] In the implementation process, distributed scanning is performed periodically at a preset frequency. Specifically, DNS resolution is performed on all subdomains and related domains and subdomains discovered based on the pre-stored domain list and the list of commonly used subdomains. That is, DNS resolution is performed on all domains and subdomains in the target domain list stored in the initial database table. The DNS resolution result is the IP address corresponding to the above domains and subdomains. All IP addresses are recorded to obtain the scan results.

[0085] After obtaining the scan results, in some embodiments, the scan results can be stored in a database. Specifically, an active TLS handshake is completed on port 443, and the scan results are stored in the database. For scan results from different periods, timestamps are used to incrementally store the scan results, achieving storage of the full TLS security configuration data in a relatively small amount of storage space.

[0086] In some embodiments, scan results from different nodes can be compared and merged to supplement data that failed to scan due to network fluctuations or other issues, resulting in processed scan results. After data processing is complete, the processed scan results are incrementally stored in the database using timestamp recording, and then entered into the database.

[0087] In some embodiments, such as Figure 2 A data storage module can be used to store the complete scan results, recording the corresponding domain name, time, and scan result. Specifically, this invention uses incremental storage to store the scan results. Considering that the deployment of HTTPS servers is relatively stable and the configuration does not change daily, a timestamp is maintained for each scan result when storing the scan results in the database. If the new scan result is consistent with the old scan result, only the timestamp needs to be updated; if the new result is inconsistent, a scan record is appended to the old scan result, and a new timestamp is maintained. This storage scheme avoids duplicate recording of data and can complete the storage of scan results for large-scale measurements with relatively small storage space.

[0088] Step 130: Perform a risk check on the scan results according to the security risk check list to obtain the risk check results.

[0089] After obtaining the scan results, risk checks are performed using these results. In some embodiments, the scan results, after data processing, are extracted from the database for risk checks. Risk checks include security risk checks on TLS deployment and certificate chains. Since the scan results include the IP addresses corresponding to all domains and subdomains in the target domain list stored in the initial database table, obtained through DNS resolution of these domains and subdomains, the TLS configuration and certificates of each domain and subdomain in the target domain list can be easily obtained from these IP addresses. Risk checks are then performed based on the TLS configuration and certificates of each domain and subdomain in the target domain list.

[0090] Specifically, the risk check is performed by traversing a security risk check list, which includes:

[0091] Check if the TLS configurations of different IP addresses under the same domain are identical;

[0092] Check whether the security of the TLS configuration complies with regulations;

[0093] Check if the certificate or certificate chain can be verified.

[0094] Check if the certificate is valid;

[0095] Check if the certificate contains a weak key;

[0096] Check if the OCSP certificate has been revoked;

[0097] Check if the certificate's CRL has been revoked;

[0098] Check the issuing authority of the certificate.

[0099] After completing the checks on the above two categories of eight security risks, it is necessary to compile statistics and then issue a security risk alert.

[0100] Step 140: Perform risk category statistics based on the risk inspection results to obtain statistical results.

[0101] Specifically, the risk inspection results are categorized and statistically analyzed according to the following risk categories, and security risk warnings are issued based on the statistical results.

[0102] Risk categories include:

[0103] New types of TLS downgrade attack risks;

[0104] TLS configuration risks;

[0105] Invalid certificate;

[0106] The certificate is about to expire;

[0107] The certificate uses a weak signature algorithm or key;

[0108] The certificate was revoked;

[0109] The certificate issuing authority provides a reminder.

[0110] In practice, the scan results are analyzed based on the safety risk checklist to determine if any safety risks exist, resulting in risk check results. Based on these results, risk categories are statistically analyzed. Specifically:

[0111] Checking whether different IP addresses under the same domain have identical TLS configurations is to check for inconsistencies in TLS version deployment. Specifically, if different IP addresses under the same domain have the same TLS configuration, then the TLS versions deployed on those IP addresses are inconsistent. A man-in-the-middle attacker could then use redirection hijacking to downgrade access to the server's TLS connection. In other words, this presents a risk of new types of TLS downgrade attacks.

[0112] Checking whether the TLS configuration security complies with regulations includes checking whether the security of the deployed TLS version conforms to the best practices specified in the current RFC. If, specifically, the TLS configuration of a domain does not conform to the best practices specified in the current RFC—for example, still using an older TLS version or failing to deploy a newer TLS version in a timely manner—then there is a TLS configuration risk.

[0113] Next, we will complete the deployment of the domain name certificate check, parse the certificate results, and compile the following statistics in sequence:

[0114] Check if the certificate or certificate chain can pass verification. If it fails, record the certificate chain verification error message. If the certificate or certificate chain deployed on the domain is not included in the trust list, it cannot be trusted by the client and cannot pass verification. In this case, it is considered an invalid certificate risk.

[0115] Check if the certificate is within its validity period. Specifically, check if it is currently valid and record the result. If the certificate deployed for the domain will expire in a short period of time (e.g., a week) and needs to be reapplied for, there is a risk that the certificate validity period is about to end.

[0116] Checking whether a certificate involves a weak key includes checking the certificate's public key signature algorithm and the number of bits to determine if a weak key is involved, and recording the key check results. If the certificate deployed for the domain uses a weak signature algorithm or key, there is a risk that the certificate uses a weak signature algorithm or key.

[0117] Checking whether a certificate's OCSP has been revoked includes checking the OCSP query results and recording them. If the OCSP check results for a domain certificate show that the certificate has been revoked and cannot be used normally, then there is a risk that the certificate has been revoked.

[0118] Checking whether a certificate's CRL has been revoked includes checking the certificate's CRL query results and recording them. If the domain certificate's CRL check results show that the domain certificate has been revoked and cannot be used normally, then there is a risk that the certificate has been revoked.

[0119] Check the certificate issuing authority and record it; if the domain name certificate issuing authority is on the blacklist or whitelist set by the administrator, and there is a risk associated with the certificate issuing authority, a warning needs to be issued.

[0120] Step 150: Generate risk assessment results based on the statistical results. The statistical results are integrated into a domain-alarm content list to obtain the risk assessment results. In some embodiments, the risk assessment results are fed back to administrators via a webpage, allowing them to intuitively understand the domains with security risks and the specific security risks. Administrators can use the final result list to monitor HTTPS servers and patch vulnerabilities and risks.

[0121] In one embodiment, for example, in a target domain list [example.edu.cn, example1.edu.cn, example2.edu.cn, sub1.example.com, sub2.example.com, ...], if sub2.example.com is deployed on two different IP addresses, but the highest supported TLS versions for the two IP addresses are 1.3 and 1.0 respectively, this will lead to a downgrade attack. Therefore, the domain sub2.example.com has a new type of TLS downgrade attack risk. This domain and its corresponding security risks are displayed in a list format in the risk assessment results on a security risk alert webpage. Administrators can reconfigure the server for sub2.example.com based on the results.

[0122] This invention provides a server security inspection method based on a domain name list. Specifically, it is a method for performing security checks on servers corresponding to a specified domain name list. It can measure the TLS and digital certificate configurations of the relevant servers in detail and comprehensively assess the security of the configurations. Based on distributed parallel scanner technology and combined with a subdomain discovery module, this invention improves the accuracy and speed of measurements, supports batch automated detection, and also supports the detection of new TLS degradation security risks. The TLS security assessment is based on RFC specifications and industry best security practices, and the measurement results are statistically analyzed. This invention addresses the security issues of Internet TLS configurations by constructing a distributed parallel scanner that automatically batch checks the TLS configuration security of a target domain name list. Based on RFC specifications and industry best security practices, it statistically analyzes the scanner's measurement results, solving the problems of manual inspection methods failing to achieve comprehensive coverage and effectively detect specific attacks.

[0123] Based on the above embodiments, the method of generating a target domain name list based on a pre-stored domain name list specifically includes:

[0124] The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate;

[0125] Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results;

[0126] Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list;

[0127] Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the query in the pre-stored passive traffic database;

[0128] The first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list are merged to obtain the target domain name list.

[0129] Specifically, the pre-stored domain name list is a list of domain names that need to be monitored, specifically the list of domain names that the user wants to monitor. This list can be a list of domain names entered by the user or an industry-default list of monitored domain names. A subdomain (or subdomain) is a domain belonging to a higher-level domain in the Domain Name System (DNS). For example, mail.example.com and calendar.example.com are two subdomains of example.com, which in turn is a subdomain of the top-level domain .com. This invention supplements and expands the list of domain names that the user wants to monitor through subdomain discovery. This is because in large enterprises and institutions, the subdomains of commonly used domains are complex and numerous, and may not be under unified management, thus potentially posing security risks and management gaps, necessitating their inclusion in the monitoring list. Specifically, the subdomain discovery process is executed using three methods. In some embodiments, the subdomain discovery process can be completed using probe nodes located at different points in the network topology.

[0130] Method 1:

[0131] The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate.

[0132] Specifically, by completing a TLS handshake, the certificates of each domain in the pre-stored domain list are obtained. This pre-stored domain list is a specified list of domains to be monitored; it is the list of domains the user wishes to monitor. This list can be a user-inputted list or an industry-default monitoring domain list. Next, the SAN field of the certificates for each domain in the pre-stored domain list is parsed, and all domains in the SAN field are saved, resulting in subdomains and related domains. These subdomains and related domains form the first domain list.

[0133] Method 2:

[0134] Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results;

[0135] Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list;

[0136] Specifically, a subdomain list is constructed as a reference subdomain list, and subdomains are enumerated on the target domain list to obtain the enumeration results. In some embodiments, common subdomains can be selected to form the reference subdomain list during its construction. In some embodiments, common subdomains can be obtained using open-source subdomain brute-force tools, such as Sublist3r. In other embodiments, open-source subdomain brute-force tools, including Aquatone and Amass, can also be used to obtain the reference subdomain list. In still other embodiments, common subdomains include: www (commonly used); mail (email); m (commonly used for mobile adaptation); blog (technical blogs, etc.); pop3 (email service); smtp (email service); support (information support page).

[0137] Perform DNS queries on the subdomains in the enumeration result. The response of the DNS query is the IP address corresponding to the subdomain. Determine whether the subdomain exists based on the response; that is, if the subdomain has a corresponding IP address, then the subdomain exists; otherwise, if the subdomain does not have a corresponding IP address, then the subdomain does not exist. Keep the existing subdomains in the enumeration result and delete the non-existent subdomains to obtain the second list of domains.

[0138] Method 3:

[0139] Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the pre-stored passive traffic database.

[0140] Specifically, each domain name in the pre-stored domain name list is queried in the passive traffic database to obtain related subdomains, thus obtaining a list of third-party domain names. In practice, a specific database called Passive DNS exists in the security field, such as VirusTotal. This database records the DNS resolution process, allowing queries to retrieve domain names and related subdomains.

[0141] Once the first, second, and third domain name lists are obtained, the subdomain discovery process is complete.

[0142] In other embodiments, the first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list are merged to obtain the target domain name list, thus supplementing the domain name list.

[0143] In some embodiments, during the execution of the subdomain discovery processes of Method 1, Method 2, and Method 3, iterations can be performed until the target domain list reaches a preset size or no new subdomains can be obtained. That is, the target domain list includes a pre-stored domain list and the iteratively completed first, second, and third domain lists. In other words, the target domain list includes all domains in the pre-stored domain list and all subdomains and related domains discovered based on the pre-stored domain list and the list of commonly used subdomains. In some embodiments, the preset size includes 500. In reality, the size of related domains and subdomains varies for commercial websites of different sizes. In small commercial websites, due to their smaller scale, there are generally only a few to dozens of subdomains, including the main domain, www, mail, and other common subdomains. In medium-sized commercial websites, due to their larger scale, there are generally hundreds to thousands of subdomains, including the main domain, multiple business subdomains, various testing environments, and backup environments. In large commercial websites, due to their very large scale, there are generally tens of thousands to hundreds of thousands of subdomains, including multiple business subdomains, distributed computing environments, CDN caching nodes, etc. For management and research purposes, different approaches can be taken depending on the situation (such as clustering to reduce redundancy of subdomains of the same type).

[0144] Based on the above embodiments, in this method, different scanning nodes simultaneously perform periodic distributed scanning on the domain names and subdomains in the initial database table at a preset frequency to obtain scanning results, and then further includes:

[0145] The scan results are stored in a database.

[0146] Specifically, after obtaining the scan results, in some embodiments, the scan results can be stored in a database. Specifically, an active TLS handshake is completed on port 443, and the scan results are then stored in the database. For scan results from different periods, timestamps are used to incrementally store the scan results, achieving storage of the full TLS security configuration data in a relatively small amount of storage space. In some embodiments, such as... Figure 2 A data storage module can be used to store the complete scan results, recording the corresponding domain name, time, and scan result. Specifically, this invention uses incremental storage to store the scan results. Considering that the deployment of HTTPS servers is relatively stable and the configuration does not change daily, a timestamp is maintained for each scan result when storing the scan results in the database. If the new scan result is consistent with the old scan result, only the timestamp needs to be updated; if the new result is inconsistent, a scan record is appended to the old scan result, and a new timestamp is maintained. This storage scheme avoids duplicate recording of data and can complete the storage of scan results for large-scale measurements with relatively small storage space.

[0147] Based on the above embodiments, storing the scan results in the database in this method specifically includes:

[0148] The scan results from different scan nodes are compared and merged, and the data from failed scans is supplemented to obtain the data processing scan results;

[0149] The data processing scan results are incrementally stored in the database by recording timestamps.

[0150] Specifically, in some embodiments, the scan results from different nodes can be compared and merged to supplement data that failed to scan due to network fluctuations or other issues, resulting in a processed scan result. After data processing is completed, the processed scan result is incrementally stored in the database using timestamp recording, and then entered into the database.

[0151] In some embodiments, such as Figure 2 A data storage module can be used to store the complete scan results, recording the corresponding domain name, time, and scan result. Specifically, this invention uses incremental storage to store the scan results. Considering that the deployment of HTTPS servers is relatively stable and the configuration does not change daily, a timestamp is maintained for each scan result when storing the scan results in the database. If the new scan result is consistent with the old scan result, only the timestamp needs to be updated; if the new result is inconsistent, a scan record is appended to the old scan result, and a new timestamp is maintained. This storage scheme avoids duplicate recording of data and can complete the storage of scan results for large-scale measurements with relatively small storage space.

[0152] Based on the above embodiments, in this method, a risk check is performed on the scan results according to a security risk check list, wherein the security risk check list specifically includes:

[0153] Check if the TLS configurations of different IP addresses under the same domain are identical;

[0154] Check whether the security of the TLS configuration complies with regulations;

[0155] Check if the certificate or certificate chain can be verified.

[0156] Check if the certificate is valid;

[0157] Check if the certificate contains a weak key;

[0158] Check if the OCSP certificate has been revoked;

[0159] Check if the certificate's CRL has been revoked;

[0160] Check the issuing authority of the certificate.

[0161] Based on the above embodiments, in this method, risk category statistics are performed according to the risk inspection results to obtain statistical results, wherein the risk categories include at least one of the following:

[0162] New types of TLS downgrade attack risks;

[0163] TLS configuration risks;

[0164] Invalid certificate;

[0165] The certificate is about to expire;

[0166] The certificate uses a weak signature algorithm or key;

[0167] The certificate was revoked;

[0168] The certificate issuing authority provides a reminder.

[0169] Specifically, in actual operation, the scan results are analyzed based on the safety risk checklist to determine if there are any safety risks, thus obtaining the risk check results. Based on these results, risk categories are statistically analyzed. Specifically:

[0170] Checking whether different IP addresses under the same domain have identical TLS configurations is to check for inconsistencies in TLS version deployment. Specifically, if different IP addresses under the same domain have the same TLS configuration, then the TLS versions deployed on those IP addresses are inconsistent. A man-in-the-middle attacker could then use redirection hijacking to downgrade access to the server's TLS connection. In other words, this presents a risk of new types of TLS downgrade attacks.

[0171] Checking whether the TLS configuration security complies with regulations includes checking whether the security of the deployed TLS version conforms to the best practices specified in the current RFC. If, specifically, the TLS configuration of a domain does not conform to the best practices specified in the current RFC—for example, still using an older TLS version or failing to deploy a newer TLS version in a timely manner—then there is a TLS configuration risk.

[0172] Next, we will complete the deployment of the domain name certificate check, parse the certificate results, and compile the following statistics in sequence:

[0173] Check if the certificate or certificate chain can pass verification. If it fails, record the certificate chain verification error message. If the certificate or certificate chain deployed on the domain is not included in the trust list, it cannot be trusted by the client and cannot pass verification. In this case, it is considered an invalid certificate risk.

[0174] Check if the certificate is within its validity period. Specifically, check if it is currently valid and record the result. If the certificate deployed for the domain will expire in a short period of time (e.g., a week) and needs to be reapplied for, there is a risk that the certificate validity period is about to end.

[0175] Checking whether a certificate involves a weak key includes checking the certificate's public key signature algorithm and the number of bits to determine if a weak key is involved, and recording the key check results. If the certificate deployed for the domain uses a weak signature algorithm or key, there is a risk that the certificate uses a weak signature algorithm or key.

[0176] Checking whether a certificate's OCSP has been revoked includes checking the OCSP query results and recording them. If the OCSP check results for a domain certificate show that the certificate has been revoked and cannot be used normally, then there is a risk that the certificate has been revoked.

[0177] Checking whether a certificate's CRL has been revoked includes checking the certificate's CRL query results and recording them. If the domain certificate's CRL check results show that the domain certificate has been revoked and cannot be used normally, then there is a risk that the certificate has been revoked.

[0178] Check the certificate issuing authority and record it; if the domain name certificate issuing authority is on the blacklist or whitelist set by the administrator, and there is a risk associated with the certificate issuing authority, a warning needs to be issued.

[0179] This invention provides a server security check method based on a domain name list. It generates a target domain name list based on a pre-stored domain name list and inputs this list into a database to obtain an initial database table. The target domain name list includes domain names from the pre-stored domain name list and subdomains obtained from the pre-stored domain name list. Different scanning nodes simultaneously perform periodic distributed scans on the domain names and subdomains in the initial database table at a preset frequency to obtain scan results. The scan results include the IP addresses of the domain names and subdomains in the initial database table. Risk checks are performed on the scan results according to a security risk check list to obtain risk check results. Risk category statistics are performed based on the risk check results to obtain statistical results. A risk assessment result is generated based on the statistical results. This invention, based on a target domain name list, utilizes a distributed parallel scanning method combined with subdomain discovery technology for server security risk checks, improving the accuracy, speed, and coverage of security checks, achieving a more comprehensive and less omission-prone security check.

[0180] The server security inspection device based on a domain name list provided by the present invention will be described below. The server security inspection device based on a domain name list described below can be referred to in correspondence with the server security inspection method based on a domain name list described above.

[0181] Figure 3 This is a schematic diagram of the server security inspection device based on a domain name list provided by the present invention, as shown below. Figure 3 As shown, it includes an initialization unit 310, a scanning unit 320, an inspection unit 330, a statistics unit 340, and an evaluation unit 350, wherein...

[0182] The initialization unit 310 is used to generate a target domain name list based on a pre-stored domain name list and input the target domain name list into a database to obtain an initial database table; the target domain name list includes domain names in the pre-stored domain name list and subdomain names obtained according to the pre-stored domain name list;

[0183] The scanning unit 320 is used to perform periodic distributed scanning of the domain names and subdomains in the initialization database table simultaneously using different scanning nodes at a preset frequency to obtain scanning results; the scanning results include the IP addresses of the domain names and subdomains in the initialization database table.

[0184] The inspection unit 330 is used to perform a risk check on the scan results according to the security risk check list to obtain the risk check results;

[0185] The statistical unit 340 is used to perform risk category statistics based on the risk inspection results to obtain statistical results;

[0186] The assessment unit 350 is used to generate risk assessment results based on the statistical results.

[0187] Based on the above embodiments, the generation of a target domain name list based on a pre-stored domain name list in this device specifically includes:

[0188] The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate;

[0189] Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results;

[0190] Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list;

[0191] Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the query in the pre-stored passive traffic database;

[0192] The first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list are merged to obtain the target domain name list.

[0193] Based on the above embodiments, in this device, different scanning nodes simultaneously perform periodic distributed scanning of the domain names and subdomains in the initial database table at a preset frequency to obtain scanning results, and then further includes:

[0194] The scan results are stored in a database.

[0195] Based on the above embodiments, in this device, storing the scan results in the database specifically includes:

[0196] The scan results from different scan nodes are compared and merged, and the data from failed scans is supplemented to obtain the data processing scan results;

[0197] The data processing scan results are incrementally stored in the database by recording timestamps.

[0198] Based on the above embodiments, in this device, the scan results are subjected to a risk check according to a security risk check list, which specifically includes:

[0199] Check if the TLS configurations of different IP addresses under the same domain are identical;

[0200] Check whether the security of the TLS configuration complies with regulations;

[0201] Check if the certificate or certificate chain can be verified.

[0202] Check if the certificate is valid;

[0203] Check if the certificate contains a weak key;

[0204] Check if the OCSP certificate has been revoked;

[0205] Check if the certificate's CRL has been revoked;

[0206] Check the issuing authority of the certificate.

[0207] Based on the above embodiments, in this device, risk category statistics are performed according to the risk inspection results to obtain statistical results, wherein the risk categories include at least one of the following:

[0208] New types of TLS downgrade attack risks;

[0209] TLS configuration risks;

[0210] Invalid certificate;

[0211] The certificate is about to expire;

[0212] The certificate uses a weak signature algorithm or key;

[0213] The certificate was revoked;

[0214] The certificate issuing authority provides a reminder.

[0215] This invention provides a server security inspection device based on a domain name list. It generates a target domain name list based on a pre-stored domain name list and inputs this list into a database to obtain an initial database table. The target domain name list includes domain names from the pre-stored domain name list and subdomains obtained from the pre-stored domain name list. Different scanning nodes simultaneously perform periodic distributed scans on the domain names and subdomains in the initial database table at a preset frequency to obtain scan results. The scan results include the IP addresses of the domain names and subdomains in the initial database table. Risk checks are performed on the scan results according to a security risk check list to obtain risk check results. Risk category statistics are performed based on the risk check results to obtain statistical results. A risk assessment result is generated based on the statistical results. This invention, based on a target domain name list, utilizes a distributed parallel scanning method combined with subdomain discovery technology for server security risk inspection, improving the accuracy, speed, and coverage of security inspections, achieving a more comprehensive and less omission-prone security inspection.

[0216] Figure 4 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 4As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430, and a communication bus 440, wherein the processor 410, the communication interface 420, and the memory 430 communicate with each other through the communication bus 440. The processor 410 can call logical instructions in the memory 430 to execute a server security check method based on a domain name list. This method includes: generating a target domain name list based on a pre-stored domain name list and recording the target domain name list into a database to obtain an initial database table; the target domain name list includes domain names in the pre-stored domain name list and subdomain names obtained based on the pre-stored domain name list; performing periodic distributed scanning on the domain names and subdomain names in the initial database table simultaneously using different scanning nodes at a preset frequency to obtain scan results; the scan results include the IP addresses of the domain names and subdomain names in the initial database table; performing risk checks on the scan results according to a security risk check list to obtain risk check results; performing risk category statistics based on the risk check results to obtain statistical results; and generating a risk assessment result based on the statistical results.

[0217] Furthermore, the logical instructions in the aforementioned memory 430 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0218] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can perform the server security check method based on a domain name list provided by the above methods. The method includes: generating a target domain name list based on a pre-stored domain name list and entering the target domain name list into a database to obtain an initial database table; the target domain name list includes domain names in the pre-stored domain name list and subdomain names obtained according to the pre-stored domain name list; performing periodic distributed scanning on the domain names and subdomain names in the initial database table simultaneously using different scanning nodes at a preset frequency to obtain scanning results; the scanning results include the IP addresses of the domain names and subdomain names in the initial database table; performing risk checks on the scanning results according to a security risk check list to obtain risk check results; performing risk category statistics according to the risk check results to obtain statistical results; and generating risk assessment results based on the statistical results.

[0219] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements a server security check method based on a domain name list provided by the above methods. This method includes: generating a target domain name list based on a pre-stored domain name list and inputting the target domain name list into a database to obtain an initialized database table; the target domain name list includes domain names in the pre-stored domain name list and subdomain names obtained based on the pre-stored domain name list; simultaneously performing periodic distributed scanning on the domain names and subdomain names in the initialized database table using different scanning nodes at a preset frequency to obtain scanning results; the scanning results include the IP addresses of the domain names and subdomain names in the initialized database table; performing risk checks on the scanning results according to a security risk check list to obtain risk check results; performing risk category statistics based on the risk check results to obtain statistical results; and generating a risk assessment result based on the statistical results.

[0220] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0221] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0222] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A server security check method based on a domain name list, characterized in that, include: A target domain name list is generated based on a pre-stored domain name list, and the target domain name list is entered into the database to obtain an initialized database table; The target domain name list includes the domain names in the pre-stored domain name list and the subdomains obtained based on the pre-stored domain name list; The domain names and subdomains in the initial database table are periodically and distributedly scanned simultaneously using different scanning nodes at a preset frequency to obtain scan results; the scan results include the IP addresses of the domain names and subdomains in the initial database table. The scan results are then subjected to a risk check based on the security risk checklist to obtain the risk check results. Based on the risk inspection results, risk categories are statistically analyzed to obtain statistical results; A risk assessment result is generated based on the statistical results. Specifically, generating the target domain name list based on the pre-stored domain name list includes: The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate; Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results; Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list; Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the query in the pre-stored passive traffic database; Merge the first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list to obtain the target domain name list; The security risk checklist specifically includes: Check if the TLS configurations of different IP addresses under the same domain are identical; Check whether the security of the TLS configuration complies with regulations; Check if the certificate or certificate chain can be verified. Check if the certificate is valid; Check if the certificate contains a weak key; Check if the OCSP certificate has been revoked; Check if the certificate's CRL has been revoked; Check the issuing authority of the certificate.

2. The server security check method based on a domain name list according to claim 1, characterized in that, The system utilizes different scanning nodes to simultaneously perform periodic distributed scans on the domain names and subdomains in the initialized database table at a preset frequency to obtain scan results. This process further includes: The scan results are stored in a database.

3. The server security check method based on a domain name list according to claim 2, characterized in that, Storing the scan results in the database specifically includes: The scan results from different scan nodes are compared and merged, and the data from failed scans is supplemented to obtain the data processing scan results; The data processing scan results are incrementally stored in the database by recording timestamps.

4. The server security check method based on a domain name list according to claim 1, characterized in that, Based on the risk inspection results, risk category statistics are performed to obtain statistical results, wherein the risk category includes at least one of the following: New types of TLS downgrade attack risks; TLS configuration risks; Invalid certificate; The certificate is about to expire; The certificate uses a weak signature algorithm or key; The certificate was revoked; The certificate issuing authority provides a reminder.

5. A server security inspection device based on a domain name list, characterized in that, include: An initialization unit is used to generate a target domain name list based on a pre-stored domain name list and input the target domain name list into a database to obtain an initial database table; The target domain name list includes the domain names in the pre-stored domain name list and the subdomains obtained based on the pre-stored domain name list; A scanning unit is used to simultaneously perform periodic distributed scanning of the domain names and subdomains in the initialization database table using different scanning nodes at a preset frequency to obtain scanning results; the scanning results include the IP addresses of the domain names and subdomains in the initialization database table. The inspection unit is used to perform a risk check on the scan results according to the security risk check list to obtain the risk check results; The statistical unit is used to perform risk category statistics based on the risk inspection results to obtain statistical results; An assessment unit is used to generate risk assessment results based on the statistical results; Specifically, generating the target domain name list based on the pre-stored domain name list includes: The certificates of the target number of domains in the pre-stored domain name list are traversed, and the SAN field of each certificate is parsed to obtain the first domain name list; the first domain name list includes the subdomains and related domain names obtained by parsing each certificate; Subdomains are enumerated based on a pre-built list of reference subdomains to obtain the enumeration results; Perform DNS queries on the subdomains in the enumeration results to obtain the response results, and filter the enumeration results based on the response results to obtain a second domain name list; Each domain in the pre-stored domain name list is queried in the pre-stored passive traffic database to obtain a third domain name list; the third domain name list includes the relevant subdomains obtained from the query in the pre-stored passive traffic database; Merge the first domain name list, the second domain name list, the third domain name list, and the pre-stored domain name list to obtain the target domain name list; The security risk checklist specifically includes: Check if the TLS configurations of different IP addresses under the same domain are identical; Check whether the security of the TLS configuration complies with regulations; Check if the certificate or certificate chain can be verified. Check if the certificate is valid; Check if the certificate contains a weak key; Check if the OCSP certificate has been revoked; Check if the certificate's CRL has been revoked; Check the issuing authority of the certificate.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the server security check method based on a domain name list as described in any one of claims 1 to 4.

7. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the server security check method based on a domain name list as described in any one of claims 1 to 4.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the server security check method based on a domain name list as described in any one of claims 1 to 4.

Images